Private Browsing Checklist Beyond Using a VPN

When people say they want to browse privately, they usually reach for one tool: a VPN, or an incognito window. Either one helps with a narrow problem, and neither one gives you the privacy that the words suggest. Privacy while browsing is built from layers, and a missing layer is often the one that leaks.

This article is a checklist, not an argument. It goes through the layers in the order data leaves your device: the device itself, the browser, your accounts, cookies, fingerprinting, the network and the DNS lookup. For each layer it explains what a VPN does, what it leaves alone and what you can do instead. If you only need the basic comparison, read VPN vs incognito mode first and come back for the full list. Using vpn and private browsing together makes sense once you know which job belongs to which layer.

Start with threats: who are you hiding from?

A checklist without a goal turns into a pile of settings. Take two minutes to name what you want to avoid, because different goals need different layers.

What you want to avoid	Main layers that help
Someone sharing your computer seeing your history	Private window, separate profile, device lock
Advertisers following you from site to site	Third-party cookie blocking, tracker blocking, fewer logged-in sessions
The cafe or hotel network seeing what you visit	VPN, HTTPS, careful network choice
Your internet provider seeing which sites you visit	VPN, encrypted DNS
A website recognising your device without cookies	Fingerprint reduction, popular browser configuration
An attacker stealing your account	Strong passwords, two-factor authentication, phishing awareness
A website knowing who you are once you log in	Nothing at the network level; log out or use separate accounts

Notice the last row. If you log in to a site, the site knows who you are, and no VPN changes that. Keep that example in mind as we go through the layers.

Layer 1: the device and the browser

Everything starts on your own hardware. A VPN does nothing for these items, and they come first because they are cheap and strong.

1. Update your operating system and browser. Updates fix flaws that attackers use. Turn on automatic updates.
2. Lock your device with a passcode and enable automatic lock.
3. Use a mainstream browser that you keep updated, and consider whether its default settings match your needs. Compare the privacy settings pages of the browser vendors, such as those from Mozilla and Google for private windows.
4. Create separate browser profiles for work, personal browsing and sensitive tasks such as banking. A profile keeps cookies and logins apart.
5. Remove extensions you do not use. Each extension can see some or all of the pages you visit. Check permissions, and install only from the official store.
6. Check for leftover search suggestions and sync. Browser sync stores history and passwords with the browser vendor. Decide on purpose whether to use it.

The cheapest wins are updates and profiles. A person who updates and separates profiles is better protected against ordinary tracking than a person who runs a VPN on an outdated browser.

Layer 2: private windows and what they really do

Private browsing, also called incognito or private mode, is one of the most misunderstood features. Mozilla and Google both document it: the mode stops the browser from saving your browsing history, cookies, site data and form entries after you close the private window.

What it does:

• Starts each private session with a clean set of cookies and ends it when the window closes.
• Prevents the browser from adding visited pages to your local history.
• Helps when you share a computer or want to check a site without your usual logins.

What it does not do:

• It does not hide your activity from websites, your internet provider, your employer or school network, or the VPN provider.
• It does not stop websites from recording your visit or link clicks.
• It does not protect you from malware, phishing or leaked passwords.
• It does not stop fingerprinting, because your device and browser still look the same.
• If you sign in to an account inside a private window, the site knows who you are.

Use private windows for local privacy: a shared family computer, gift shopping, or a quick login to another account. Combine them with a VPN when you also want the network around you to see less. Read can you be tracked with a VPN for what remains visible with a tunnel running.

Layer 3: accounts and logins

Most tracking you notice comes from accounts, not from clever tricks. When you sign in, you hand the site a stable identity.

• Sign out of large accounts when you do not need them, especially search, social and video accounts, or keep those accounts in a separate browser profile.
• Review the activity and ad personalization settings of your main accounts. Many services let you pause history or ad personalization, and some let you delete past activity.
• Use different email addresses for different purposes. A shopping address and a personal address are harder to link.
• Use a password manager with unique passwords, and turn on two-factor authentication. This does not make browsing private, but it prevents someone else from reading your accounts. Our article on what two-factor authentication is explains the options.
• Be careful with "sign in with" buttons. They link the new site to an existing account and can share profile details.

If you must stay logged in to an account all day, accept that the service will see your activity inside its own platform. A VPN will not change that.

Layer 4: cookies, trackers and fingerprints

Cookies are small files that sites store in your browser. First-party cookies keep you logged in and remember your cart. Third-party cookies, set by other companies whose content is embedded in the page, are used to follow you between sites.

Cookie checklist

1. Block third-party cookies in your browser settings. Most major browsers now offer this, and some do it by default.
2. Allow cookies for the sites you trust and actually use.
3. Clear cookies and site data after sensitive sessions or on shared devices, rather than every day by habit.
4. Review site permissions: location, notifications, camera and microphone. Deny anything a site does not need.

Tracker blocking

1. Use the browser's built-in tracking protection, or an extension from a reputable developer, to block known trackers and unwanted scripts. Keep the list small, because each extension adds to your fingerprint and your trust requirements. Our article on VPN browser extension vs VPN app explains the same trade-offs for VPN extensions.
2. Treat "privacy" extensions from unknown publishers with suspicion. Some collect more than they block.

Fingerprinting

Fingerprinting identifies a browser by combining many small details: screen size, fonts, language, time zone, graphics hardware and more. It works without cookies. To see how identifiable your browser is, run the EFF Cover Your Tracks test. It shows whether trackers are blocked and how unique your configuration looks.

To reduce fingerprinting:

• Prefer a common, current browser configuration over a heavily modified one. Rare setups stand out.
• Do not stack many extensions that change page behaviour.
• Use the browser's built-in fingerprint protection if it offers one.
• Accept that a determined tracker will still identify some visitors, and focus on reducing the easy tracking first.

A VPN changes the network address only. It does not alter your screen size, fonts or browser version, so fingerprinting works the same with or without it.

Layer 5: the network and where a VPN fits

Now we reach the layer that a VPN does cover. Between your device and the website there is a local network, an internet provider and many routers.

What a VPN adds at this layer:

• It hides the sites you visit and the content of your traffic from the local network, such as cafe or hotel Wi-Fi.
• It limits what your internet provider can log about your browsing.
• It changes the address that sites see for your connection.

What it does not add:

• It does not hide what you do from the sites you log in to.
• It does not stop cookies or fingerprinting.
• It does not make you anonymous, and it moves some trust from your network to the VPN provider.

The HTTPS padlock already encrypts the content of most sites, so on a trusted home network a VPN adds less than people expect. On shared Wi-Fi it adds more. The article on HTTPS vs VPN walks through the differences, and does a VPN hide your IP address covers the address question in more detail.

To use a VPN well while browsing:

1. Connect before opening the browser, and check that the app shows connected. With XPASS you sign in to the free VPNclient app with the username and password on your My Pass page; the download page lists the official apps.
2. Do not assume that a connected VPN means every leak is covered. After setup, run a simple test as in our guide to checking whether your VPN is working.
3. Keep HTTPS on. If your browser warns about a site's certificate, stop and think.

Layer 6: DNS, WebRTC and other leaks

Before your browser loads a page, it asks a DNS server to turn the name into an address. By default, that query often goes to your internet provider, which is why the provider can see the names of sites even if the page itself is encrypted.

• Encrypted DNS (DNS over HTTPS or DNS over TLS) hides these queries from the local network. You can switch it on in many browsers. Our article on DNS over HTTPS vs VPN explains whether you need both.
• A DNS leak happens when queries bypass the VPN tunnel and reach your normal provider. Learn how to spot one in what is a DNS leak.
• WebRTC is a browser feature for calls and video that can reveal network addresses in some setups. Check for it with the tests described in our guides, and adjust browser settings if a test shows your normal address.

These are the layer where a VPN and browser settings must agree. If you run a VPN but your DNS or WebRTC bypasses it, you have lost part of the benefit without noticing.

The full checklist in one place

Use this list when you set up a new device or review an old one.

Once, at setup

1. Turn on automatic updates for system, browser and apps.
2. Set a screen lock.
3. Create profiles for work, personal and sensitive tasks.
4. Block third-party cookies and enable built-in tracking protection.
5. Enable encrypted DNS if your browser or system offers it.
6. Review and remove extensions.
7. Turn on two-factor authentication for important accounts.
8. Install and test your VPN app on each device you use on shared networks.

Each time on a shared network

1. Connect the VPN first, then open the browser.
2. Avoid logging in to sensitive accounts if you can use mobile data instead.
3. Check that sites show HTTPS.

Every month or so

1. Review installed extensions and site permissions.
2. Clear site data you no longer need.
3. Review account activity and ad settings.
4. Run the EFF Cover Your Tracks test again and note any changes.

Common mistakes

• Treating a VPN as a complete privacy solution and then logging in to every account.
• Believing that a private window hides your activity from your employer or provider.
• Installing many "privacy" extensions that make your browser easier to identify.
• Clearing cookies every day but never blocking third-party ones.
• Ignoring updates because "nothing is wrong".
• Using a free VPN extension from an unknown publisher; see are free VPNs safe.
• Forgetting that a shared device keeps a trail even after you leave.

Summary

Private browsing is a stack of layers: a patched device, a well-configured browser, careful accounts, blocked trackers, a limited fingerprint and a protected network. A VPN covers the network layer, which matters most on shared Wi-Fi, but it does not replace the rest. Work through the checklist once, keep it light, and revisit it every few months.

If you want a simple prepaid way to cover the network layer on trips or shared Wi-Fi, you can see the pricing page whenever you like.